In today’s cloud native world, traditional security tools can’t keep up with the speed and complexity of containers. This talk dives into how Falco, powered by eBPF, watches every syscall in real time to detect abnormal behavior before it becomes a breach. You’ll learn how to build a real-time intrusion detection system for Kubernetes using open source tools — with actionable rules, live alerts, and full visibility into your cluster’s runtime activity.

Whether you're a DevSecOps engineer or security enthusiast, this session will leave you equipped to defend your workloads with deep, kernel-level insights — all using open source